Browse public community intelligence reports, source analysis, and threat research.
29 intel reports
Chinese-speaking actor leepsmarts executes the KeyHunter Operation, stealing 2,233 LLM API keys and orchestrating an academic fraud campaign targeting 20 universities.
China-state aligned actor Storm-0940 utilized the ARTEX agentic AI framework to automate a large-scale supply chain compromise targeting ConnectWise applications and downstream cloud environments.
Comprehensive analysis of Active Directory exploitation techniques including NTLM relaying, Kerberos delegation abuse, and AD Certificate Services vulnerabilities.
The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
SafePay ransomware actors target global critical infrastructure by exploiting edge device vulnerabilities and using legitimate administrative tools for data exfiltration and hybrid encryption.
The suspected PRC-nexus actor ARMORY CASTLE exploited a zero-day vulnerability in BeyondTrust Remote Support appliances to deploy custom SAWFLY webshells and BARECLAW tunnelers for credential theft and lateral movement.
An unknown actor used a compromised ConnectWise Cloud Backup (SkyKick) application credential to sign in to customer Microsoft 365 tenants as the application itself, with Huntress reporting successful sign-ins in over 300 tenants.
Varonis Threat Labs identified TrustSink, a post-compromise technique where attackers with high privileges register rogue External Authentication Methods (EAM) in Microsoft Entra to capture plaintext passwords during legitimate MFA flows.
ARToken is a Phishing-as-a-Service platform that abuses Microsoft's OAuth 2.0 device code flow to bypass MFA and achieve full Entra tenant takeover.
